prisma-risk / tsoracle / 26491073736

95%

push

github

fix(core/allocator): try_prepare_window_extension +1 overflow guard reported wrong operand (#565)

The `committed_high_water.checked_add(1)?` guard reported
`PhysicalMsOutOfRange(*committed_high_water)` on overflow — but that
operand is in range; the value that actually went out of range is
`committed_high_water + 1`. A reader of the error would see an in-range
number and infer the wrong root cause.

The branch is also dead: `try_on_leadership_gained` rejects
`committed_ceiling > PHYSICAL_MS_MAX` and `try_commit_window_extension`
does the same for any subsequent advance, so `committed_high_water` is
bounded at `PHYSICAL_MS_MAX = (1 << 46) - 1`, many orders of magnitude
below `u64::MAX`. The +1 cannot overflow without an upstream invariant
violation.

Replace with a `debug_assert!` that documents the invariant and trips
loudly in debug if it is ever broken. Release-mode safety is preserved
by the existing downstream `requested > PHYSICAL_MS_MAX` check at
line 463: a hypothetical wraparound would surface there.

Signed-off-by: Sebastian Thiebaud <sebastian@prismarisk.com>

3 of 5 new or added lines in 1 file covered. (60.0%)

13760 of 14494 relevant lines covered (94.94%)

379505.54 hits per line